Bug 761646 (CVE-2011-4594) - CVE-2011-4594 kernel: send(m)msg: user pointer dereferences
Summary: CVE-2011-4594 kernel: send(m)msg: user pointer dereferences
Alias: CVE-2011-4594
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 760798 761668
Blocks: 761664
TreeView+ depends on / blocked
Reported: 2011-12-08 19:11 UTC by Petr Matousek
Modified: 2023-05-11 18:26 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2013-04-05 15:42:47 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2012:0350 0 normal SHIPPED_LIVE Moderate: kernel security and bug fix update 2012-03-06 23:43:05 UTC

Description Petr Matousek 2011-12-08 19:11:10 UTC
Dereferencing a user pointer directly from kernel-space without going through the copy_from_user family of functions is a bad idea. Two of such usages can be found in the sendmsg code path called from sendmmsg, added by upstream commit c71d8ebe7a4496fb7231151cb70a6baa0cb56f9a. Usages are performed through memcmp() and memcpy() directly. 

Upstream fix: http://git.kernel.org/linus/bc909d9ddbf7778371e36a651d6e4194b1cc7d4c


Red Hat would like to thank Tetsuo Handa for reporting this issue. Upstream acknowledges Mathieu Desnoyers as the original reporter.

Comment 3 Petr Matousek 2011-12-09 13:51:26 UTC

This issue did not affect the versions of Linux kernel as shipped with Red Hat
Enterprise Linux 4, 5 and Red Hat Enterprise MRG as they did not provide support for the sendmmsg syscall. This has been addressed in Red Hat Enterprise Linux 6 via https://rhn.redhat.com/errata/RHSA-2012-0350.html.

Comment 4 errata-xmlrpc 2012-03-06 18:45:15 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:0350 https://rhn.redhat.com/errata/RHSA-2012-0350.html

Note You need to log in before you can comment on or make changes to this bug.